AWS Penetration Testing Insights

In today's digital landscape, ensuring security is crucial, and Amazon Web Services (AWS) recognizes this significance by offering robust security measures. To provide the utmost protection, AWS provides a comprehensive guide on penetration testing. In this detailed blog post, we will delve into AWS penetration testing, aligning ourselves with AWS's guidelines, to help you effectively safeguard your AWS infrastructure.

It's important to conduct AWS penetration testing, also known as ethical hacking. This proactive approach helps identify vulnerabilities and security weaknesses in your AWS infrastructure. By resolving these issues before they're exploited, you can significantly reduce the risk of security breaches and data compromises.

I wanted to share some of the important reasons why AWS Penetration Testing is crucial:

1. Enhancing Security: Identifying vulnerabilities in advance can help you improve your overall security posture proactively.

2. Regulatory Compliance: It is often required by various industries and regulatory bodies to conduct regular penetration testing as part of compliance efforts.

3. Protecting Sensitive Data: Since AWS frequently hosts sensitive data, penetration tests can ensure the security of this information.

4. Building Trust: Regularly conducting penetration testing shows your dedication to security, which can help establish trust with customers and partners.

Customer Service Policy for Penetration Testing
Permitted Services

1. Amazon EC2 instances, WAF, NAT Gateways, and Elastic Load Balancers
2. Amazon RDS
3. Amazon CloudFront
4. Amazon Aurora
5. Amazon API Gateways
6. AWS AppSync
7. AWS Lambda and Lambda Edge functions
8. Amazon Lightsail resources
9. Amazon Elastic Beanstalk environments
10. Amazon Elastic Container Service
11. AWS Fargate
12. Amazon Elasticsearch
13. Amazon FSx
14. Amazon Transit Gateway
15. S3 hosted applications (targeting S3 buckets is strictly prohibited)

Prohibited Activities

1. DNS zone walking via Amazon Route 53 Hosted Zones
2. DNS hijacking via Route 53
3. DNS Pharming via Route 53
4. Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS (These are subject to the DDoS Simulation Testing policy
5. Port flooding
6. Protocol flooding
7. Request flooding (login request flooding, API request flooding)

Customers seeking to test non approved services will need to work directly with their AWS Support Team.

Please keep in mind that when performing security testing, it is important to follow the AWS Security Testing Terms and Conditions:

• Only perform security testing on the agreed-upon services, network bandwidth, requests per minute, and instance type.
• Use security assessment tools and services in accordance with AWS's policy.
• Security testing is subject to the Amazon Web Services Customer Agreement between you and AWS.
• If any vulnerabilities or issues are discovered during the testing that are a direct result of AWS's tools or services, please report them to AWS Security aws-security@amazon.com within 24 hours of completing the testing.

AWS have a policy that outlines how to use security assessment tools and services.

• A security tool that remotely queries your AWS asset to determine a software name and version is not a violation. A tool or service that crashes a running process temporarily for remote or local exploitation as part of the security assessment is not in violation.
• However, you can't use tools or services that perform DoS attacks or simulations against any AWS asset. You also can't use tools or services that create, determine, or demonstrate a DoS condition in any other manner. Customers wishing to perform a DDoS simulation test should review AWS's DDoS Simulation Testing policy.
• It's your responsibility to ensure that the tools and services used for security assessments do not perform DoS attacks or simulations. You should also validate that the tool or service employed does not perform such attacks before performing a security assessment of any AWS assets.

Reference: AWS Security Documentation on Penetration Testing